/** * AWS Signature V4 signing for HTTP requests. WebCrypto-only — no node:crypto. * * Matches `@smithy/signature-v4` for our usage: header-based signing with a * full SHA-256 payload hash (Bedrock requires `applyChecksum: true`). * * Returns the set of headers to attach to the request: * - `host` * - `x-amz-date` * - `x-amz-content-sha256` * - `x-amz-security-token` (only when credentials carry a sessionToken) * - `authorization` */ export interface AwsCredentials { accessKeyId: string; secretAccessKey: string; sessionToken?: string; } export interface SignParams { method: string; /** Hostname only — used to build the `host` header and the canonical request. */ host: string; /** URI path component, e.g. `/model/anthropic.claude/converse-stream`. */ path: string; /** Optional pre-built query string (without leading `?`). */ query?: string; /** Extra headers to sign in addition to `host`/`x-amz-*`. Names are case-insensitive. */ headers?: Record; body: Uint8Array; region: string; service: string; credentials: AwsCredentials; /** Override clock for deterministic tests. */ date?: Date; } export declare function toHex(bytes: Uint8Array): string; export declare function sha256(data: Uint8Array | string): Promise; export declare function sha256Hex(data: Uint8Array | string): Promise; /** * Derive a signing key: HMAC chain `kSecret → kDate → kRegion → kService → kSigning`. */ export declare function getSigningKey(secretAccessKey: string, shortDate: string, region: string, service: string): Promise; /** `YYYYMMDDTHHMMSSZ` + 8-char `YYYYMMDD`. */ export declare function formatAmzDate(d: Date): { longDate: string; shortDate: string; }; export interface SignedHeaders { host: string; "x-amz-date": string; "x-amz-content-sha256": string; authorization: string; "x-amz-security-token"?: string; } export declare function signRequest(params: SignParams): Promise;